Workos vulnerabilities

Products

• Authkit-nextjs 3
• Authkit-remix 2

Newest

• workos authkit-session @workos/authkit-session: Open Redirect via state-derived redirect target CVE-2026-42565 Fix available 4.3 MediumMay 5, 2026
• workos authkit-nextjs authkit-nextjs may let session cookies be cached in CDNs CVE-2025-64762 Fix available 8.0 HighNovember 20, 2025
• workos authkit-remix AuthKit: Sensitive auth data rendered in HTML CVE-2025-55009 Fix available 7.1 HighAugust 8, 2025
• workos authkit-react-router AuthKit React Router: Sensitive auth data rendered in HTML CVE-2025-55008 Fix available 7.1 HighAugust 8, 2025
• workos hosted authkit WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling... CVE-2025-23017 6.0 MediumFebruary 24, 2025
• workos authkit-remix Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix CVE-2024-51753 Fix available 2.1 LowNovember 5, 2024
• workos authkit-nextjs Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs CVE-2024-51752 Fix available 2.1 LowNovember 5, 2024
• workos authkit-nextjs @workos-inc/authkit-nextjs session replay vulnerability CVE-2024-29901 Fix available 4.8 MediumMarch 29, 2024